1. Security should never be a paid “feature”. 2. SMS-based 2-factor authentication is not very secure.